From 0aa54412345e83758c3f0daa5bf23dda209f2555 Mon Sep 17 00:00:00 2001
From: Brian Hardie <777730+bhardie@users.noreply.github.com>
Date: Wed, 1 Jul 2026 13:21:06 -0700
Subject: [PATCH] [APIH-1912] Set up SonarQube code analysis

---
 .github/workflows/sonar.yaml | 28 ++++++++++++++++++++++++++++
 sonar-project.properties     | 25 +++++++++++++++++++++++++
 2 files changed, 53 insertions(+)
 create mode 100644 .github/workflows/sonar.yaml
 create mode 100644 sonar-project.properties

diff --git a/.github/workflows/sonar.yaml b/.github/workflows/sonar.yaml
new file mode 100644
index 0000000..e3f3718
--- /dev/null
+++ b/.github/workflows/sonar.yaml
@@ -0,0 +1,28 @@
+on:
+  push:
+    branches:
+      - develop
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+name: Sonarqube
+jobs:
+  sonarqube:
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.user.login != 'dependabot[bot]'
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: SonarQube Scan
+        uses: sonarsource/sonarqube-scan-action@45f27363d4ff7d6b16baa0516490f10c52bdd5fc
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
+
+      - name: SonarQube Quality Gate check
+        uses: sonarsource/sonarqube-quality-gate-action@8e9b0ca0a7273d6f16986388d98393efdfcf56fd
+        timeout-minutes: 5
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
diff --git a/sonar-project.properties b/sonar-project.properties
new file mode 100644
index 0000000..4ae514a
--- /dev/null
+++ b/sonar-project.properties
@@ -0,0 +1,25 @@
+# Server and project configuration
+sonar.host.url=https://sonar.wpengine.io/
+sonar.projectVersion=1.0
+sonar.sourceEncoding=UTF-8
+sonar.scm.provider=git
+
+# Project identifiers
+sonar.projectName=wpackagist
+sonar.projectKey=wpengine_wpackagist_82f90787-67b8-45bc-8b47-99fbcfb1c1e7
+
+# Language
+sonar.language=php
+
+# Paths to source code directories (relative paths)
+sonar.sources=src
+
+# Exclusions
+sonar.exclusions=**/*_test.*, **/mocks/**, **/node_modules/**, **/vendor/**
+
+# Paths to test code directories (relative paths)
+sonar.tests=.
+sonar.test.inclusions=**/*Test.php
+
+# Public repo: disable PR decoration to limit exposure of internal project details
+sonar.pullrequest.github.summary.comment=false